Merge pull request #83 from paralus/proj-scoped-role-creation

Fixed creating project scoped role failed from cli

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+## Fixed
+
+- Fixed creating project scoped role failed from cli [niravparikh05](https://github.com/niravparikh05)
+
 ## [0.1.5] - 2022-10-10
 
 ## Fixed

internal/dao/role.go

@@ -38,3 +38,16 @@ func GetRolePermissionsByScope(ctx context.Context, db bun.IDB, scope string) ([
 	}
 	return r, nil
 }
+
+func GetRolePermissionsByNames(ctx context.Context, db bun.IDB, permissions ...string) ([]models.ResourcePermission, error) {
+	var r = []models.ResourcePermission{}
+	err := db.NewSelect().Table("authsrv_resourcepermission").
+		ColumnExpr("authsrv_resourcepermission.name as name, authsrv_resourcepermission.description as description, authsrv_resourcepermission.scope as scope").
+		Where("name IN (?)", bun.In(permissions)).
+		Where("authsrv_resourcepermission.trash = ?", false).
+		Scan(ctx, &r)
+	if err != nil {
+		return nil, err
+	}
+	return r, nil
+}

pkg/service/audit_utils.go

@@ -444,7 +444,7 @@ func RevokeKubeconfigAuditEvent(ctx context.Context, al *zap.Logger, user string
 	}
 }
 
-func CreateClusterAuditEvent(ctx context.Context, al *zap.Logger, action string, name string, id uuid.UUID) {
+func CreateClusterAuditEvent(ctx context.Context, al *zap.Logger, action string, name string, id uuid.UUID, project string) {
 	sd, ok := GetSessionDataFromContext(ctx)
 	if !ok {
 		_log.Warn("unable to create audit event: could not fetch info from context")
@@ -457,7 +457,7 @@ func CreateClusterAuditEvent(ctx context.Context, al *zap.Logger, action string,
 			"cluster_name": name,
 		},
 	}
-	if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("cluster.%s.success", action), ""); err != nil {
+	if err := audit.CreateV1Event(al, sd, detail, fmt.Sprintf("cluster.%s.success", action), project); err != nil {
 		_log.Warn("unable to create audit event", err)
 	}
 }

pkg/service/cluster.go

@@ -299,7 +299,7 @@ func (s *clusterService) Create(ctx context.Context, cluster *infrav3.Cluster) (
 		h.OnChange(ev)
 	}
 
-	CreateClusterAuditEvent(ctx, s.al, AuditActionCreate, clusterResp.GetMetadata().GetName(), edb.ID)
+	CreateClusterAuditEvent(ctx, s.al, AuditActionCreate, clusterResp.GetMetadata().GetName(), edb.ID, cluster.Metadata.Project)
 	return clusterResp, nil
 }
 
@@ -598,13 +598,14 @@ func (s *clusterService) Update(ctx context.Context, cluster *infrav3.Cluster) (
 		h.OnChange(ev)
 	}*/
 
-	CreateClusterAuditEvent(ctx, s.al, AuditActionUpdate, cluster.GetMetadata().GetName(), cdb.ID)
+	CreateClusterAuditEvent(ctx, s.al, AuditActionUpdate, cluster.GetMetadata().GetName(), cdb.ID, cluster.Metadata.Project)
 
 	return cluster, nil
 }
 
 func (s *clusterService) Delete(ctx context.Context, cluster *infrav3.Cluster) error {
 
+	projectName := cluster.Metadata.Project
 	cluster, err := s.Get(ctx, func(qo *commonv3.QueryOptions) {
 		qo.Name = cluster.Metadata.Name
 		qo.Project = cluster.Metadata.Project
@@ -646,7 +647,7 @@ func (s *clusterService) Delete(ctx context.Context, cluster *infrav3.Cluster) e
 
 	id, err := uuid.Parse(clusterId)
 	if err == nil {
-		CreateClusterAuditEvent(ctx, s.al, AuditActionDelete, cluster.GetMetadata().GetName(), id)
+		CreateClusterAuditEvent(ctx, s.al, AuditActionDelete, cluster.GetMetadata().GetName(), id, projectName)
 	}
 	return nil
 

pkg/service/rolepermission.go

@@ -92,6 +92,13 @@ func (s *rolepermissionService) List(ctx context.Context, opts ...query.Option)
 			}
 			rles = append(rles, rps...)
 		}
+		// add partner and organization read roles as it is organization scoped yet required by all
+		rps, err := dao.GetRolePermissionsByNames(ctx, s.db, partnerR, organizationR)
+		if err != nil {
+			return rolepermissionList, err
+		}
+		rles = append(rles, rps...)
+
 		for _, rle := range rles {
 			entry := &rolev3.RolePermission{}
 			entry = s.toV3Rolepermission(entry, &rle)

pkg/service/rolepermission_test.go

@@ -76,6 +76,10 @@ func TestRolePermissionListWithSelectors(t *testing.T) {
 		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "name"}).
 		AddRow(ruuid2, "role-"+ruuid2))
 
+	mock.ExpectQuery(`SELECT authsrv_resourcepermission.name as name, authsrv_resourcepermission.description as description, authsrv_resourcepermission.scope as scope FROM "authsrv_resourcepermission" WHERE \(name IN \('partner.read', 'organization.read'\)\) AND \(authsrv_resourcepermission.trash = FALSE\)`).
+		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "name"}).
+		AddRow(ruuid2, "role-"+ruuid2).AddRow(ruuid1, "role-"+ruuid1))
+
 	req := &commonv3.QueryOptions{
 		Partner:      "partner-" + puuid,
 		Organization: "org-" + ouuid,
@@ -85,7 +89,7 @@ func TestRolePermissionListWithSelectors(t *testing.T) {
 	if err != nil {
 		t.Fatal("could not list rolepermissions:", err)
 	}
-	if rolelist.Metadata.Count != 2 {
+	if rolelist.Metadata.Count != 4 {
 		t.Errorf("incorrect number of rolepermissions returned, expected 2; got %v", rolelist.Metadata.Count)
 	}
 	if rolelist.Items[0].Metadata.Name != "role-"+ruuid1 || rolelist.Items[1].Metadata.Name != "role-"+ruuid2 {